Security controls is the collective term for security classifications and security groups, which in turn are made up of one or more security marks.
There is one predefined Classification security group, and you have the option to add as many additional security groups as you need.
Both files and records can be classified using their Classify option to apply a security classification and security marks. When a file or record is classified it can only be seen by those with the required security clearance, and the security classification level is shown on screen. Users without the necessary security clearance won't have access to it or even know that it's there. When a classified file is declared as a record it retains its classification level and security marks.
User security clearance is set for a user (or user group) by assigning security marks to them.